camstack 1.2.67 → 1.2.69

package/dist/{launcher-5FCVBL5M.js → launcher-INC5TETK.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Keu5TDO7.js
-var require_dist_Keu5TDO7 = __commonJS({
-  "../system/dist/dist-Keu5TDO7.js"(exports) {
+// ../system/dist/dist-B29Skpzo.js
+var require_dist_B29Skpzo = __commonJS({
+  "../system/dist/dist-B29Skpzo.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26274,6 +26274,20 @@ var require_dist_Keu5TDO7 = __commonJS({
       * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
       */
       rowsReconciled: zod.z.number().int().nonnegative().optional(),
+      /**
+      * Rows this run FORGOT because the file they name is not on disk.
+      *
+      * The mover derived the path from the row's own fields and `stat`ed it; an
+      * ENOENT there is a per-path confirmation that the segment is gone (D296),
+      * and the durable row is dropped through the same channel eviction uses. It
+      * is reported for the same reason `rowsReconciled` is: this is a durable
+      * mutation nobody asked for, and a migration that quietly erases hour rows is
+      * the same failure as one that quietly skips them (D295).
+      *
+      * The production drain of 2026-08-30 would have reported 11 074 here — the
+      * ledger claimed 5.65 GB of footage that no longer existed.
+      */
+      rowsForgotten: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -26481,6 +26495,71 @@ var require_dist_Keu5TDO7 = __commonJS({
       segments: zod.z.number().int().nonnegative(),
       bytes: zod.z.number().int().nonnegative()
     }).nullable();
+    var LedgerWalkInputSchema = zod.z.object({
+      locationId: zod.z.string().min(1),
+      /** Forget the confirmed-absent rows, rather than only counting them. */
+      apply: zod.z.boolean().optional(),
+      /** Narrow to one camera. */
+      deviceId: zod.z.number().int().positive().optional(),
+      /** Narrow to these recording profiles; empty/absent = every profile. */
+      profiles: zod.z.array(zod.z.string().min(1)).optional()
+    });
+    var LedgerWalkRefusalSchema = zod.z.enum([
+      "location-unknown",
+      "source-writable",
+      "no-ledger",
+      "archive-unreadable",
+      "anchor-absent",
+      "anchor-unreadable",
+      "anchor-moved"
+    ]);
+    zod.z.enum([
+      "live-tail",
+      "listing-error",
+      "path-mismatch",
+      "durable-refused"
+    ]);
+    var LedgerWalkSkipCountsSchema = zod.z.object({
+      "live-tail": zod.z.number().int().nonnegative(),
+      "listing-error": zod.z.number().int().nonnegative(),
+      "path-mismatch": zod.z.number().int().nonnegative(),
+      "durable-refused": zod.z.number().int().nonnegative()
+    });
+    var LedgerWalkDeviceReportSchema = zod.z.object({
+      deviceId: zod.z.number().int(),
+      hoursWalked: zod.z.number().int().nonnegative(),
+      hoursMissing: zod.z.number().int().nonnegative(),
+      ghostSegments: zod.z.number().int().nonnegative(),
+      ghostBytes: zod.z.number().int().nonnegative(),
+      forgottenSegments: zod.z.number().int().nonnegative(),
+      orphanFiles: zod.z.number().int().nonnegative()
+    });
+    var LedgerWalkReportSchema = zod.z.object({
+      locationId: zod.z.string(),
+      applied: zod.z.boolean(),
+      refused: LedgerWalkRefusalSchema.nullable(),
+      archiveSegments: zod.z.number().int().nonnegative().nullable(),
+      archiveBytes: zod.z.number().int().nonnegative().nullable(),
+      hoursClaimed: zod.z.number().int().nonnegative(),
+      hoursWalked: zod.z.number().int().nonnegative(),
+      hoursMissing: zod.z.number().int().nonnegative(),
+      /** `readdir` calls issued — the cost, stated in the unit that is paid. */
+      listings: zod.z.number().int().nonnegative(),
+      segmentsClaimed: zod.z.number().int().nonnegative(),
+      ghostSegments: zod.z.number().int().nonnegative(),
+      ghostBytes: zod.z.number().int().nonnegative(),
+      ghostHoursWhole: zod.z.number().int().nonnegative(),
+      forgottenSegments: zod.z.number().int().nonnegative(),
+      forgottenBytes: zod.z.number().int().nonnegative(),
+      /** Files under a claimed hour that no durable row names. Never deleted. */
+      orphanFiles: zod.z.number().int().nonnegative(),
+      orphanSample: zod.z.array(zod.z.string()).readonly(),
+      hoursSkipped: zod.z.number().int().nonnegative(),
+      skippedByReason: LedgerWalkSkipCountsSchema,
+      /** The walk stopped at its per-pass hour bound with claims unwalked. */
+      bounded: zod.z.boolean(),
+      byDevice: zod.z.array(LedgerWalkDeviceReportSchema).readonly()
+    });
     var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
     var RelocatableMediaCountInputSchema = zod.z.object({
       toLocationId: zod.z.string().min(1),
@@ -36998,13 +37077,15 @@ var require_dist_Keu5TDO7 = __commonJS({
       groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
       nextCursor: zod.z.string().nullable()
     });
+    var KEY_EVENTS_DEFAULT_LIMIT = 50;
+    var KEY_EVENTS_MAX_LIMIT = 200;
     var KeyEventQueryInput = zod.z.object({
       deviceId: zod.z.number(),
       /** Window lower bound (track firstSeen ≥ since). */
       since: zod.z.number(),
       /** Window upper bound (track firstSeen ≤ until). */
       until: zod.z.number(),
-      limit: zod.z.number().int().min(1).max(200).default(50),
+      limit: zod.z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
       /** Drop tracks scoring below this importance. */
       minImportance: zod.z.number().min(0).max(1).optional(),
       /** Restrict to a single class (e.g. 'person'). */
@@ -37026,6 +37107,21 @@ var require_dist_Keu5TDO7 = __commonJS({
       ...TrackFlagFields,
       ...TrackRetrainFields
     });
+    var KeyEventBatchQueryInput = zod.z.object({
+      deviceIds: zod.z.array(zod.z.number()).min(1).max(200),
+      since: zod.z.number(),
+      until: zod.z.number(),
+      /** Applied PER CAMERA, exactly as `getKeyEvents.limit` is — never a total
+      *  across the set, which would let a busy camera starve a quiet one of its
+      *  rows and change what the merged feed contains. */
+      limit: zod.z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
+      minImportance: zod.z.number().min(0).max(1).optional(),
+      classFilter: zod.z.string().optional()
+    });
+    var KeyEventsForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      events: zod.z.array(KeyEventSchema).readonly()
+    });
     zod.z.object({
       trackId: zod.z.string(),
       className: zod.z.string(),
@@ -37094,6 +37190,25 @@ var require_dist_Keu5TDO7 = __commonJS({
       totalBytes: zod.z.number().int(),
       devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
     });
+    var EventMediaKindFootprintSchema = zod.z.object({
+      kind: MediaFileKindEnum,
+      /** Media rows of this kind. */
+      rows: zod.z.number().int(),
+      /** Bytes on disk held by those rows. */
+      bytes: zod.z.number().int()
+    });
+    var EventMediaKindBreakdownSchema = zod.z.object({
+      /** Every media row in scope, from one unfiltered aggregate. */
+      totalRows: zod.z.number().int(),
+      /** Every media byte in scope, from that same aggregate. */
+      totalBytes: zod.z.number().int(),
+      /** Per-kind footprint, ordered by bytes descending. */
+      kinds: zod.z.array(EventMediaKindFootprintSchema).readonly(),
+      /** `totalRows` minus the summed `kinds` rows — see the schema note. */
+      unaccountedRows: zod.z.number().int(),
+      /** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+      unaccountedBytes: zod.z.number().int()
+    });
     var EventPruneCountsSchema = zod.z.object({
       motion: zod.z.number().int(),
       object: zod.z.number().int(),
@@ -37301,6 +37416,21 @@ var require_dist_Keu5TDO7 = __commonJS({
         * scored on-read (no write). Degrades to `[]` on error.
         */
         getKeyEvents: method(KeyEventQueryInput, zod.z.array(KeyEventSchema).readonly()),
+        /**
+        * The same ranking, for a SET of cameras, in one round trip.
+        *
+        * The Detection Intelligence events feed asks this of every selected
+        * camera and re-asks on a 30s timer. Fanned out client-side that is N
+        * round trips — browser → hub → post-analysis — for N independent,
+        * already-indexed store queries. Batched, the queries are unchanged and
+        * run concurrently INSIDE the owner; only the transport collapses.
+        *
+        * Deliberately per-device rather than pre-merged: `limit` stays per
+        * camera (a total would let a busy camera starve a quiet one), and a
+        * caller that renders one camera's lane needs to know which camera a row
+        * came from. `getKeyEvents` stays for single-device callers.
+        */
+        getKeyEventsBatch: method(KeyEventBatchQueryInput, zod.z.array(KeyEventsForDeviceSchema).readonly()),
         /** Server-side bucketed event counts for the 24-hour timeline.
         *  Returns one entry per non-empty bucket; empty buckets are omitted. */
         getEventDensity: method(zod.z.object({
@@ -37449,6 +37579,22 @@ var require_dist_Keu5TDO7 = __commonJS({
           auth: "admin"
         }),
         /**
+        * The same media footprint, broken down by {@link MediaFileKind} instead of
+        * by camera — fleet-wide, or for one camera with `deviceId`.
+        *
+        * Separate from {@link getEventStoreFootprint} rather than a field on it:
+        * the two answer different questions on different axes, the per-camera one
+        * is what the management table renders on every open, and nothing should
+        * pay for a per-kind pass to draw it. See
+        * {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+        * `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+        * to anyone sizing a deletion against it.
+        */
+        getEventMediaFootprintByKind: method(zod.z.object({ deviceId: zod.z.number().int().optional() }), EventMediaKindBreakdownSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
+        /**
         * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
         * every camera, deleting each event's media in lockstep. Logged to the
         * events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -40047,6 +40193,20 @@ var require_dist_Keu5TDO7 = __commonJS({
         listProviders: method(zod.z.void(), zod.z.array(ProviderListEntrySchema).readonly()),
         testConfig: method(zod.z.object({
           providerId: zod.z.string(),
+          /**
+          * The location this config is an UNSAVED edit of, when there is one.
+          *
+          * `listLocations` replaces every declared secret with the redaction
+          * sentinel, so the edit modal's form state holds the sentinel for any
+          * credential the operator did not retype — and posting that here
+          * without a way to resolve it makes the provider try to authenticate
+          * as `__camstack_redacted__` and report the operator's own working
+          * password as wrong. Given this id, the orchestrator restores each
+          * sentinel from the stored config (same rule as `upsertLocation`)
+          * before dispatching. Omitted by the "Add location" wizard, where
+          * every value was typed just now and nothing is stored yet.
+          */
+          locationId: zod.z.string().optional(),
           config: zod.z.record(zod.z.string(), zod.z.unknown())
         }), zod.z.object({
           ok: zod.z.boolean(),
@@ -47215,6 +47375,23 @@ var require_dist_Keu5TDO7 = __commonJS({
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * Does this location's LEDGER tell the truth about its disk? (D319)
+        *
+        * One `readdir` per claimed hour, diffed both ways: durable rows whose file
+        * is not there, and files no durable row names. `apply` defaults to FALSE —
+        * the report is the product, and the dry run is how an operator
+        * sanity-checks the destructive run before authorising it.
+        *
+        * REFUSES a source that is still a write target: a listing of a live
+        * location is a lower bound, which is not the strong evidence that lets
+        * this pass forget without a budget. A live location is reconciled by the
+        * mover, under D318's bound.
+        */
+        reconcileLedgerAgainstDisk: method(LedgerWalkInputSchema, LedgerWalkReportSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -47512,6 +47689,10 @@ var require_dist_Keu5TDO7 = __commonJS({
       monitors: zod.z.array(SceneMonitorSchema),
       lastFetchedAt: zod.z.number()
     });
+    var SceneMonitorStatusForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      status: SceneMonitorStatusSchema.nullable()
+    });
     var sceneMonitorCapability = {
       name: "scene-monitor",
       scope: "device",
@@ -47521,6 +47702,22 @@ var require_dist_Keu5TDO7 = __commonJS({
       deviceTypes: [DeviceType.Camera],
       methods: {
         listScenes: method(zod.z.object({ deviceId: zod.z.number() }), SceneMonitorStatusSchema),
+        /**
+        * The same answer, for a SET of cameras, in one round trip.
+        *
+        * `/scenes` renders every camera and re-reads them on a 30s safety-net
+        * poll behind the push slice. Fanned out client-side that was one query
+        * per camera — 29 round trips through the browser, the hub and the
+        * post-analysis runner every 30 seconds to read an in-memory map the
+        * owner had already merged. The work is unchanged (`statusFor` per
+        * device, all in-process at the owner); what collapses is the transport.
+        *
+        * A camera that cannot answer still gets a row, with `status: null` —
+        * see {@link SceneMonitorStatusForDeviceSchema}. Never fewer rows than
+        * ids: a caller that asked for twenty-nine and got twenty-seven cannot
+        * tell which two are missing, or that any are.
+        */
+        listScenesBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(SceneMonitorStatusForDeviceSchema).readonly()),
         createScene: method(zod.z.object({
           deviceId: zod.z.number(),
           label: zod.z.string(),
@@ -49321,6 +49518,11 @@ var require_dist_Keu5TDO7 = __commonJS({
       *  than as repeated tracks/events. */
       stationaryObjects: zod.z.array(StationaryObjectSchema).readonly().optional()
     });
+    var CameraOccupancySnapshotForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      read: zod.z.enum(["read", "unreadable"]),
+      snapshot: CameraOccupancySnapshotSchema.nullable()
+    });
     var HistoryResolutionEnum = zod.z.enum([
       "minute",
       "5min",
@@ -49350,6 +49552,20 @@ var require_dist_Keu5TDO7 = __commonJS({
         *  (no inference result emitted since boot or since binding was
         *  activated). */
         getCurrentSnapshot: method(zod.z.object({ deviceId: zod.z.number() }), CameraOccupancySnapshotSchema.nullable()),
+        /**
+        * The same snapshot, for a SET of cameras, in one round trip.
+        *
+        * The Events page's Stationary section polls this every 15s for every
+        * selected camera. Fanned out client-side that is one query per camera to
+        * read a `Map.get` at the owner — the answer costs nothing, the round trip
+        * costs everything. Batched, N transports become one and the per-device
+        * work is unchanged.
+        *
+        * Every requested deviceId gets a row, tagged `read` — see
+        * {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+        * not answer for is `'unreadable'`, never an empty reading.
+        */
+        getCurrentSnapshotBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
         /** Time-series object count inside one zone. `className` optional —
         *  omit to count every class in the zone. */
         getZoneHistory: method(zod.z.object({
@@ -53273,6 +53489,12 @@ var require_dist_Keu5TDO7 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getEventMediaFootprintByKind": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getEventStoreFootprint": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -53291,6 +53513,12 @@ var require_dist_Keu5TDO7 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getKeyEventsBatch": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getMotionEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -54467,6 +54695,12 @@ var require_dist_Keu5TDO7 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "recording.reconcileLedgerAgainstDisk": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "recording.refreshStorageLocationsForMigration": {
         capName: "recording",
         capScope: "system",
@@ -54593,6 +54827,12 @@ var require_dist_Keu5TDO7 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "sceneMonitor.listScenesBatch": {
+        capName: "scene-monitor",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "sceneMonitor.recheckNow": {
         capName: "scene-monitor",
         capScope: "device",
@@ -55949,6 +56189,12 @@ var require_dist_Keu5TDO7 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "zoneAnalytics.getCurrentSnapshotBatch": {
+        capName: "zone-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "zoneAnalytics.getUnzonedHistory": {
         capName: "zone-analytics",
         capScope: "device",
@@ -56938,6 +57184,11 @@ var require_dist_Keu5TDO7 = __commonJS({
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getEventMediaFootprintByKind": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "pipelineAnalytics.getGroup": [{
         name: "deviceId",
         form: "single",
@@ -56948,6 +57199,11 @@ var require_dist_Keu5TDO7 = __commonJS({
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getKeyEventsBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.getMotionEvents": [{
         name: "deviceId",
         form: "single",
@@ -57388,6 +57644,11 @@ var require_dist_Keu5TDO7 = __commonJS({
         form: "single",
         optional: false
       }],
+      "recording.reconcileLedgerAgainstDisk": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "recording.relocateFootage": [{
         name: "deviceId",
         form: "single",
@@ -57453,6 +57714,11 @@ var require_dist_Keu5TDO7 = __commonJS({
         form: "single",
         optional: false
       }],
+      "sceneMonitor.listScenesBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "sceneMonitor.recheckNow": [{
         name: "deviceId",
         form: "single",
@@ -57714,6 +57980,11 @@ var require_dist_Keu5TDO7 = __commonJS({
         form: "single",
         optional: false
       }],
+      "zoneAnalytics.getCurrentSnapshotBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "zoneAnalytics.getUnzonedHistory": [{
         name: "deviceId",
         form: "single",
@@ -59147,7 +59418,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59966,7 +60237,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -60060,7 +60331,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60957,11 +61228,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-BBohF-eC.js
-var require_retired_settings_keys_BBohF_eC = __commonJS({
-  "../system/dist/retired-settings-keys-BBohF-eC.js"(exports) {
+// ../system/dist/retired-settings-keys-CRL0qOnU.js
+var require_retired_settings_keys_CRL0qOnU = __commonJS({
+  "../system/dist/retired-settings-keys-CRL0qOnU.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63175,8 +63446,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
-    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
+    var require_dist10 = require_dist_B29Skpzo();
+    var require_retired_settings_keys = require_retired_settings_keys_CRL0qOnU();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67989,7 +68260,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -68126,7 +68397,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -68316,7 +68587,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -76129,7 +76400,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76694,7 +76965,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -79316,7 +79587,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80432,8 +80703,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
-    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
+    var require_dist10 = require_dist_B29Skpzo();
+    var require_retired_settings_keys = require_retired_settings_keys_CRL0qOnU();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82812,7 +83083,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -83795,10 +84066,21 @@ var require_storage_orchestrator_addon = __commonJS({
         declareCollection: async (input) => (await engine()).declareCollection(input)
       };
     }
-    var EMPTY_SECRET_KEYS = /* @__PURE__ */ new Set();
+    var FRAMEWORK_CONFIG_KEYS = /* @__PURE__ */ new Set([
+      "basePath",
+      "readOnly",
+      "maxUsedGb",
+      "minFreePercent"
+    ]);
     function secretKeysOfProviderInfo(info) {
       return require_dist10.collectSecretConfigKeys(info.configSchema);
     }
+    function secretKeysForConfig(config, declared) {
+      if (declared !== void 0) return declared;
+      const out = /* @__PURE__ */ new Set();
+      for (const key of Object.keys(config)) if (!FRAMEWORK_CONFIG_KEYS.has(key)) out.add(key);
+      return out;
+    }
     function redactLocationConfig(config, secretKeys) {
       if (secretKeys.size === 0) return config;
       let touched = false;
@@ -84784,7 +85066,7 @@ var require_storage_orchestrator_addon = __commonJS({
           listLocationDeclarations: async () => service.listDeclarations(),
           upsertLocation: async (input) => {
             const stored = service.getLocationById(input.id);
-            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId));
+            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
             const saved = service.upsertLocation(config === input.config ? input : {
               ...input,
               config
@@ -84817,11 +85099,14 @@ var require_storage_orchestrator_addon = __commonJS({
               } });
             });
           },
-          testConfig: async ({ providerId, config }) => {
+          testConfig: async ({ providerId, locationId, config }) => {
+            const stored = locationId === void 0 ? void 0 : service.getLocationById(locationId);
+            const base = stored?.providerId === providerId ? stored.config : void 0;
+            const resolved = restoreRedactedSecrets(config, base, this.secretKeysFor(providerId, base ?? {}));
             const providers = getProviders();
             for (const p of providers) try {
               if ((await p.getProviderInfo()).providerId !== providerId) continue;
-              return p.testLocation({ config });
+              return p.testLocation({ config: resolved });
             } catch (err) {
               return {
                 ok: false,
@@ -85141,13 +85426,21 @@ var require_storage_orchestrator_addon = __commonJS({
         }
         return out;
       }
-      /** Declared secret config keys for a provider; empty when unknown. */
-      secretKeysFor(providerId) {
-        return this.secretKeysByProvider.get(providerId) ?? EMPTY_SECRET_KEYS;
+      /**
+      * What the provider's own schema declared secret, or `undefined` when this
+      * node has never heard from that provider. The distinction is the whole
+      * point — see `secretKeysForConfig`, which fails CLOSED on `undefined`.
+      */
+      declaredSecretKeys(providerId) {
+        return this.secretKeysByProvider.get(providerId);
+      }
+      /** Which keys of a given stored config must never leave this process. */
+      secretKeysFor(providerId, config) {
+        return secretKeysForConfig(config, this.declaredSecretKeys(providerId));
       }
       /** A location with its provider's declared secrets replaced by the sentinel. */
       redacted(location) {
-        return redactLocation(location, this.secretKeysFor(location.providerId));
+        return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
       }
       /**
       * Is this location backed by a provider that serves a genuine local
@@ -85387,7 +85680,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -103448,7 +103741,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -105391,9 +105684,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-C3AniWy-.js
-var require_sleep_C3AniWy = __commonJS({
-  "../types/dist/sleep-C3AniWy-.js"(exports) {
+// ../types/dist/sleep-DIg3xuEw.js
+var require_sleep_DIg3xuEw = __commonJS({
+  "../types/dist/sleep-DIg3xuEw.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -108076,6 +108369,7 @@ var require_sleep_C3AniWy = __commonJS({
           listEventKindsBatch: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listEventKindsBatch", "query", input),
           getSensorEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getSensorEvents", "query", input),
           getKeyEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getKeyEvents", "query", input),
+          getKeyEventsBatch: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getKeyEventsBatch", "query", input),
           getEventDensity: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventDensity", "query", input),
           pruneEventsBefore: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneEventsBefore", "mutation", input),
           pruneTracksBefore: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneTracksBefore", "mutation", input),
@@ -108084,6 +108378,7 @@ var require_sleep_C3AniWy = __commonJS({
           deleteTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteTracks", "mutation", input),
           setTrackFlags: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setTrackFlags", "mutation", input),
           getEventStoreFootprint: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventStoreFootprint", "query", input),
+          getEventMediaFootprintByKind: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMediaFootprintByKind", "query", input),
           pruneEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneEvents", "mutation", input),
           deleteDeviceEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteDeviceEvents", "mutation", input),
           pauseForStorageMigration: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pauseForStorageMigration", "mutation", input),
@@ -108156,6 +108451,7 @@ var require_sleep_C3AniWy = __commonJS({
         reboot: { reboot: (input) => dispatch("reboot", "reboot", "reboot", "mutation", input) },
         sceneMonitor: {
           listScenes: (input) => dispatch("scene-monitor", "sceneMonitor", "listScenes", "query", input),
+          listScenesBatch: (input) => dispatch("scene-monitor", "sceneMonitor", "listScenesBatch", "query", input),
           createScene: (input) => dispatch("scene-monitor", "sceneMonitor", "createScene", "mutation", input),
           updateScene: (input) => dispatch("scene-monitor", "sceneMonitor", "updateScene", "mutation", input),
           deleteScene: (input) => dispatch("scene-monitor", "sceneMonitor", "deleteScene", "mutation", input),
@@ -108240,6 +108536,7 @@ var require_sleep_C3AniWy = __commonJS({
         },
         zoneAnalytics: {
           getCurrentSnapshot: (input) => dispatch("zone-analytics", "zoneAnalytics", "getCurrentSnapshot", "query", input),
+          getCurrentSnapshotBatch: (input) => dispatch("zone-analytics", "zoneAnalytics", "getCurrentSnapshotBatch", "query", input),
           getZoneHistory: (input) => dispatch("zone-analytics", "zoneAnalytics", "getZoneHistory", "query", input),
           getCameraHistory: (input) => dispatch("zone-analytics", "zoneAnalytics", "getCameraHistory", "query", input),
           getUnzonedHistory: (input) => dispatch("zone-analytics", "zoneAnalytics", "getUnzonedHistory", "query", input)
@@ -109060,7 +109357,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_C3AniWy();
+    var require_sleep = require_sleep_DIg3xuEw();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -109170,6 +109467,7 @@ var require_addon = __commonJS({
       "pipeline-analytics": {
         "getAudioEvents": { "limit": 1e3 },
         "getKeyEvents": { "limit": 50 },
+        "getKeyEventsBatch": { "limit": 50 },
         "getMotionEvents": { "limit": 1e3 },
         "getObjectEvents": { "limit": 1e3 },
         "getSensorEvents": { "limit": 1e3 },
@@ -115942,12 +116240,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-DYv4ZPo2.js
-var require_manifest_system_deps_DYv4ZPo2 = __commonJS({
-  "../system/dist/manifest-system-deps-DYv4ZPo2.js"(exports) {
+// ../system/dist/manifest-system-deps-DBje540e.js
+var require_manifest_system_deps_DBje540e = __commonJS({
+  "../system/dist/manifest-system-deps-DBje540e.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_Keu5TDO7();
+    require_dist_B29Skpzo();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -127976,7 +128274,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Keu5TDO7();
+    var require_dist10 = require_dist_B29Skpzo();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -128002,7 +128300,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_DYv4ZPo2();
+    var require_manifest_system_deps = require_manifest_system_deps_DBje540e();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -133890,19 +134188,37 @@ var require_dist3 = __commonJS({
       if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
       return parsed.value;
     }
+    var PREFIX_PAGE_ROWS = 1e3;
+    var PREFIX_PAGE_BUDGET = 512;
     async function loadPrefixed(door, collection, prefix) {
       const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
-      const rows = await door.query({
-        collection,
-        ...range !== null ? { filter: { whereBetween: { id: [range.lo, range.hi] } } } : {}
-      });
       const result = {};
-      for (const row of rows) {
-        if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
-        if (!row.id.startsWith(prefix)) continue;
-        result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+      let cursor = range?.lo ?? null;
+      for (let page = 0; ; page++) {
+        if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read \u2014 a partial scope read is indistinguishable from an empty one.`);
+        const rows = await door.query({
+          collection,
+          filter: {
+            ...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
+            orderBy: {
+              field: "id",
+              direction: "asc"
+            },
+            limit: PREFIX_PAGE_ROWS
+          }
+        });
+        for (const row of rows) {
+          if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+          if (!row.id.startsWith(prefix)) continue;
+          result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+        }
+        if (rows.length < PREFIX_PAGE_ROWS) return result;
+        const last = rows[rows.length - 1];
+        if (last === void 0) return result;
+        if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page \u2014 the answer would be partial. Use an ASCII, non-empty prefix.`);
+        if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" \u2014 ids under a prefix must be unique.`);
+        cursor = last.id;
       }
-      return result;
     }
     async function replacePrefixed(door, collection, prefix, values, wrap3) {
       const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
@@ -208826,7 +209142,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_C3AniWy();
+    var require_sleep = require_sleep_DIg3xuEw();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -210173,6 +210489,20 @@ var require_dist4 = __commonJS({
       * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
       */
       rowsReconciled: zod.z.number().int().nonnegative().optional(),
+      /**
+      * Rows this run FORGOT because the file they name is not on disk.
+      *
+      * The mover derived the path from the row's own fields and `stat`ed it; an
+      * ENOENT there is a per-path confirmation that the segment is gone (D296),
+      * and the durable row is dropped through the same channel eviction uses. It
+      * is reported for the same reason `rowsReconciled` is: this is a durable
+      * mutation nobody asked for, and a migration that quietly erases hour rows is
+      * the same failure as one that quietly skips them (D295).
+      *
+      * The production drain of 2026-08-30 would have reported 11 074 here — the
+      * ledger claimed 5.65 GB of footage that no longer existed.
+      */
+      rowsForgotten: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -210380,6 +210710,71 @@ var require_dist4 = __commonJS({
       segments: zod.z.number().int().nonnegative(),
       bytes: zod.z.number().int().nonnegative()
     }).nullable();
+    var LedgerWalkInputSchema = zod.z.object({
+      locationId: zod.z.string().min(1),
+      /** Forget the confirmed-absent rows, rather than only counting them. */
+      apply: zod.z.boolean().optional(),
+      /** Narrow to one camera. */
+      deviceId: zod.z.number().int().positive().optional(),
+      /** Narrow to these recording profiles; empty/absent = every profile. */
+      profiles: zod.z.array(zod.z.string().min(1)).optional()
+    });
+    var LedgerWalkRefusalSchema = zod.z.enum([
+      "location-unknown",
+      "source-writable",
+      "no-ledger",
+      "archive-unreadable",
+      "anchor-absent",
+      "anchor-unreadable",
+      "anchor-moved"
+    ]);
+    var LedgerWalkSkipReasonSchema = zod.z.enum([
+      "live-tail",
+      "listing-error",
+      "path-mismatch",
+      "durable-refused"
+    ]);
+    var LedgerWalkSkipCountsSchema = zod.z.object({
+      "live-tail": zod.z.number().int().nonnegative(),
+      "listing-error": zod.z.number().int().nonnegative(),
+      "path-mismatch": zod.z.number().int().nonnegative(),
+      "durable-refused": zod.z.number().int().nonnegative()
+    });
+    var LedgerWalkDeviceReportSchema = zod.z.object({
+      deviceId: zod.z.number().int(),
+      hoursWalked: zod.z.number().int().nonnegative(),
+      hoursMissing: zod.z.number().int().nonnegative(),
+      ghostSegments: zod.z.number().int().nonnegative(),
+      ghostBytes: zod.z.number().int().nonnegative(),
+      forgottenSegments: zod.z.number().int().nonnegative(),
+      orphanFiles: zod.z.number().int().nonnegative()
+    });
+    var LedgerWalkReportSchema = zod.z.object({
+      locationId: zod.z.string(),
+      applied: zod.z.boolean(),
+      refused: LedgerWalkRefusalSchema.nullable(),
+      archiveSegments: zod.z.number().int().nonnegative().nullable(),
+      archiveBytes: zod.z.number().int().nonnegative().nullable(),
+      hoursClaimed: zod.z.number().int().nonnegative(),
+      hoursWalked: zod.z.number().int().nonnegative(),
+      hoursMissing: zod.z.number().int().nonnegative(),
+      /** `readdir` calls issued — the cost, stated in the unit that is paid. */
+      listings: zod.z.number().int().nonnegative(),
+      segmentsClaimed: zod.z.number().int().nonnegative(),
+      ghostSegments: zod.z.number().int().nonnegative(),
+      ghostBytes: zod.z.number().int().nonnegative(),
+      ghostHoursWhole: zod.z.number().int().nonnegative(),
+      forgottenSegments: zod.z.number().int().nonnegative(),
+      forgottenBytes: zod.z.number().int().nonnegative(),
+      /** Files under a claimed hour that no durable row names. Never deleted. */
+      orphanFiles: zod.z.number().int().nonnegative(),
+      orphanSample: zod.z.array(zod.z.string()).readonly(),
+      hoursSkipped: zod.z.number().int().nonnegative(),
+      skippedByReason: LedgerWalkSkipCountsSchema,
+      /** The walk stopped at its per-pass hour bound with claims unwalked. */
+      bounded: zod.z.boolean(),
+      byDevice: zod.z.array(LedgerWalkDeviceReportSchema).readonly()
+    });
     var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
     var RelocatableMediaCountInputSchema = zod.z.object({
       toLocationId: zod.z.string().min(1),
@@ -222879,13 +223274,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
       nextCursor: zod.z.string().nullable()
     });
+    var KEY_EVENTS_DEFAULT_LIMIT = 50;
+    var KEY_EVENTS_MAX_LIMIT = 200;
     var KeyEventQueryInput = zod.z.object({
       deviceId: zod.z.number(),
       /** Window lower bound (track firstSeen ≥ since). */
       since: zod.z.number(),
       /** Window upper bound (track firstSeen ≤ until). */
       until: zod.z.number(),
-      limit: zod.z.number().int().min(1).max(200).default(50),
+      limit: zod.z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
       /** Drop tracks scoring below this importance. */
       minImportance: zod.z.number().min(0).max(1).optional(),
       /** Restrict to a single class (e.g. 'person'). */
@@ -222907,6 +223304,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       ...TrackFlagFields,
       ...TrackRetrainFields
     });
+    var KeyEventBatchQueryInput = zod.z.object({
+      deviceIds: zod.z.array(zod.z.number()).min(1).max(200),
+      since: zod.z.number(),
+      until: zod.z.number(),
+      /** Applied PER CAMERA, exactly as `getKeyEvents.limit` is — never a total
+      *  across the set, which would let a busy camera starve a quiet one of its
+      *  rows and change what the merged feed contains. */
+      limit: zod.z.number().int().min(1).max(KEY_EVENTS_MAX_LIMIT).default(KEY_EVENTS_DEFAULT_LIMIT),
+      minImportance: zod.z.number().min(0).max(1).optional(),
+      classFilter: zod.z.string().optional()
+    });
+    var KeyEventsForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      events: zod.z.array(KeyEventSchema).readonly()
+    });
     var TrackedDetectionSchema = zod.z.object({
       trackId: zod.z.string(),
       className: zod.z.string(),
@@ -222975,6 +223387,25 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       totalBytes: zod.z.number().int(),
       devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
     });
+    var EventMediaKindFootprintSchema = zod.z.object({
+      kind: MediaFileKindEnum,
+      /** Media rows of this kind. */
+      rows: zod.z.number().int(),
+      /** Bytes on disk held by those rows. */
+      bytes: zod.z.number().int()
+    });
+    var EventMediaKindBreakdownSchema = zod.z.object({
+      /** Every media row in scope, from one unfiltered aggregate. */
+      totalRows: zod.z.number().int(),
+      /** Every media byte in scope, from that same aggregate. */
+      totalBytes: zod.z.number().int(),
+      /** Per-kind footprint, ordered by bytes descending. */
+      kinds: zod.z.array(EventMediaKindFootprintSchema).readonly(),
+      /** `totalRows` minus the summed `kinds` rows — see the schema note. */
+      unaccountedRows: zod.z.number().int(),
+      /** `totalBytes` minus the summed `kinds` bytes — see the schema note. */
+      unaccountedBytes: zod.z.number().int()
+    });
     var EventPruneCountsSchema = zod.z.object({
       motion: zod.z.number().int(),
       object: zod.z.number().int(),
@@ -223182,6 +223613,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * scored on-read (no write). Degrades to `[]` on error.
         */
         getKeyEvents: require_sleep.method(KeyEventQueryInput, zod.z.array(KeyEventSchema).readonly()),
+        /**
+        * The same ranking, for a SET of cameras, in one round trip.
+        *
+        * The Detection Intelligence events feed asks this of every selected
+        * camera and re-asks on a 30s timer. Fanned out client-side that is N
+        * round trips — browser → hub → post-analysis — for N independent,
+        * already-indexed store queries. Batched, the queries are unchanged and
+        * run concurrently INSIDE the owner; only the transport collapses.
+        *
+        * Deliberately per-device rather than pre-merged: `limit` stays per
+        * camera (a total would let a busy camera starve a quiet one), and a
+        * caller that renders one camera's lane needs to know which camera a row
+        * came from. `getKeyEvents` stays for single-device callers.
+        */
+        getKeyEventsBatch: require_sleep.method(KeyEventBatchQueryInput, zod.z.array(KeyEventsForDeviceSchema).readonly()),
         /** Server-side bucketed event counts for the 24-hour timeline.
         *  Returns one entry per non-empty bucket; empty buckets are omitted. */
         getEventDensity: require_sleep.method(zod.z.object({
@@ -223330,6 +223776,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           auth: "admin"
         }),
         /**
+        * The same media footprint, broken down by {@link MediaFileKind} instead of
+        * by camera — fleet-wide, or for one camera with `deviceId`.
+        *
+        * Separate from {@link getEventStoreFootprint} rather than a field on it:
+        * the two answer different questions on different axes, the per-camera one
+        * is what the management table renders on every open, and nothing should
+        * pay for a per-kind pass to draw it. See
+        * {@link EventMediaKindBreakdownSchema} for why `unaccounted*` exists —
+        * `kinds` is enumerated, `totalBytes` is not, and the gap must be visible
+        * to anyone sizing a deletion against it.
+        */
+        getEventMediaFootprintByKind: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().optional() }), EventMediaKindBreakdownSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
+        /**
         * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
         * every camera, deleting each event's media in lockstep. Logged to the
         * events ops-log with `reason` (default `'retention'`). Returns the summed
@@ -226092,6 +226554,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         listProviders: require_sleep.method(zod.z.void(), zod.z.array(ProviderListEntrySchema).readonly()),
         testConfig: require_sleep.method(zod.z.object({
           providerId: zod.z.string(),
+          /**
+          * The location this config is an UNSAVED edit of, when there is one.
+          *
+          * `listLocations` replaces every declared secret with the redaction
+          * sentinel, so the edit modal's form state holds the sentinel for any
+          * credential the operator did not retype — and posting that here
+          * without a way to resolve it makes the provider try to authenticate
+          * as `__camstack_redacted__` and report the operator's own working
+          * password as wrong. Given this id, the orchestrator restores each
+          * sentinel from the stored config (same rule as `upsertLocation`)
+          * before dispatching. Omitted by the "Add location" wizard, where
+          * every value was typed just now and nothing is stored yet.
+          */
+          locationId: zod.z.string().optional(),
           config: zod.z.record(zod.z.string(), zod.z.unknown())
         }), zod.z.object({
           ok: zod.z.boolean(),
@@ -233269,6 +233745,23 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * Does this location's LEDGER tell the truth about its disk? (D319)
+        *
+        * One `readdir` per claimed hour, diffed both ways: durable rows whose file
+        * is not there, and files no durable row names. `apply` defaults to FALSE —
+        * the report is the product, and the dry run is how an operator
+        * sanity-checks the destructive run before authorising it.
+        *
+        * REFUSES a source that is still a write target: a listing of a live
+        * location is a lower bound, which is not the strong evidence that lets
+        * this pass forget without a budget. A live location is reconciled by the
+        * mover, under D318's bound.
+        */
+        reconcileLedgerAgainstDisk: require_sleep.method(LedgerWalkInputSchema, LedgerWalkReportSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -233583,6 +234076,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       monitors: zod.z.array(SceneMonitorSchema),
       lastFetchedAt: zod.z.number()
     });
+    var SceneMonitorStatusForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      status: SceneMonitorStatusSchema.nullable()
+    });
     var sceneMonitorCapability = {
       name: "scene-monitor",
       scope: "device",
@@ -233592,6 +234089,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceTypes: [require_sleep.DeviceType.Camera],
       methods: {
         listScenes: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), SceneMonitorStatusSchema),
+        /**
+        * The same answer, for a SET of cameras, in one round trip.
+        *
+        * `/scenes` renders every camera and re-reads them on a 30s safety-net
+        * poll behind the push slice. Fanned out client-side that was one query
+        * per camera — 29 round trips through the browser, the hub and the
+        * post-analysis runner every 30 seconds to read an in-memory map the
+        * owner had already merged. The work is unchanged (`statusFor` per
+        * device, all in-process at the owner); what collapses is the transport.
+        *
+        * A camera that cannot answer still gets a row, with `status: null` —
+        * see {@link SceneMonitorStatusForDeviceSchema}. Never fewer rows than
+        * ids: a caller that asked for twenty-nine and got twenty-seven cannot
+        * tell which two are missing, or that any are.
+        */
+        listScenesBatch: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(SceneMonitorStatusForDeviceSchema).readonly()),
         createScene: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
           label: zod.z.string(),
@@ -235393,6 +235906,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  than as repeated tracks/events. */
       stationaryObjects: zod.z.array(StationaryObjectSchema).readonly().optional()
     });
+    var CameraOccupancySnapshotForDeviceSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      read: zod.z.enum(["read", "unreadable"]),
+      snapshot: CameraOccupancySnapshotSchema.nullable()
+    });
     var HistoryResolutionEnum = zod.z.enum([
       "minute",
       "5min",
@@ -235422,6 +235940,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         *  (no inference result emitted since boot or since binding was
         *  activated). */
         getCurrentSnapshot: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), CameraOccupancySnapshotSchema.nullable()),
+        /**
+        * The same snapshot, for a SET of cameras, in one round trip.
+        *
+        * The Events page's Stationary section polls this every 15s for every
+        * selected camera. Fanned out client-side that is one query per camera to
+        * read a `Map.get` at the owner — the answer costs nothing, the round trip
+        * costs everything. Batched, N transports become one and the per-device
+        * work is unchanged.
+        *
+        * Every requested deviceId gets a row, tagged `read` — see
+        * {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+        * not answer for is `'unreadable'`, never an empty reading.
+        */
+        getCurrentSnapshotBatch: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
         /** Time-series object count inside one zone. `className` optional —
         *  omit to count every class in the zone. */
         getZoneHistory: require_sleep.method(zod.z.object({
@@ -242263,6 +242795,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getEventMediaFootprintByKind": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getEventStoreFootprint": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -242281,6 +242819,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.getKeyEventsBatch": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.getMotionEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -243457,6 +244001,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "recording.reconcileLedgerAgainstDisk": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "recording.refreshStorageLocationsForMigration": {
         capName: "recording",
         capScope: "system",
@@ -243583,6 +244133,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "sceneMonitor.listScenesBatch": {
+        capName: "scene-monitor",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "sceneMonitor.recheckNow": {
         capName: "scene-monitor",
         capScope: "device",
@@ -244939,6 +245495,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "zoneAnalytics.getCurrentSnapshotBatch": {
+        capName: "zone-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "zoneAnalytics.getUnzonedHistory": {
         capName: "zone-analytics",
         capScope: "device",
@@ -246186,6 +246748,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getEventMediaFootprintByKind": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "pipelineAnalytics.getGroup": [{
         name: "deviceId",
         form: "single",
@@ -246196,6 +246763,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "pipelineAnalytics.getKeyEventsBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.getMotionEvents": [{
         name: "deviceId",
         form: "single",
@@ -246636,6 +247208,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "recording.reconcileLedgerAgainstDisk": [{
+        name: "deviceId",
+        form: "single",
+        optional: true
+      }],
       "recording.relocateFootage": [{
         name: "deviceId",
         form: "single",
@@ -246701,6 +247278,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "sceneMonitor.listScenesBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "sceneMonitor.recheckNow": [{
         name: "deviceId",
         form: "single",
@@ -246962,6 +247544,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "zoneAnalytics.getCurrentSnapshotBatch": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "zoneAnalytics.getUnzonedHistory": [{
         name: "deviceId",
         form: "single",
@@ -247114,6 +247701,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "recording.readGopBytes",
       "recording.readSegmentBytes",
       "recording.readWindowBytes",
+      "recording.reconcileLedgerAgainstDisk",
       "recording.relocateFootage",
       "recording.renderClip",
       "recording.renderGif",
@@ -247999,6 +248587,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           relocateFootage: (input) => dispatch("recording", "relocateFootage", "mutation", input),
           listRelocateJobs: (input) => dispatch("recording", "listRelocateJobs", "query", input),
           getRelocateResidue: (input) => dispatch("recording", "getRelocateResidue", "query", input),
+          reconcileLedgerAgainstDisk: (input) => dispatch("recording", "reconcileLedgerAgainstDisk", "mutation", input),
           cancelRelocateJob: (input) => dispatch("recording", "cancelRelocateJob", "mutation", input),
           planStorageRebalance: (input) => dispatch("recording", "planStorageRebalance", "query", input),
           startStorageRebalance: (input) => dispatch("recording", "startStorageRebalance", "mutation", input)
@@ -250959,6 +251548,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CameraMetricsSchema = CameraMetricsSchema;
     exports.CameraMetricsWithDeviceIdSchema = CameraMetricsWithDeviceIdSchema;
     exports.CameraMotionStatusSchema = CameraMotionStatusSchema;
+    exports.CameraOccupancySnapshotForDeviceSchema = CameraOccupancySnapshotForDeviceSchema;
     exports.CameraRecordingModeSchema = CameraRecordingModeSchema;
     exports.CameraRecordingStatusSchema = CameraRecordingStatusSchema;
     exports.CameraSourceStatusSchema = CameraSourceStatusSchema;
@@ -251209,6 +251799,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.LabelTierSchema = LabelTierSchema;
     exports.LawnMowerActivitySchema = LawnMowerActivitySchema;
     exports.LawnMowerControlStatusSchema = LawnMowerControlStatusSchema;
+    exports.LedgerWalkDeviceReportSchema = LedgerWalkDeviceReportSchema;
+    exports.LedgerWalkInputSchema = LedgerWalkInputSchema;
+    exports.LedgerWalkRefusalSchema = LedgerWalkRefusalSchema;
+    exports.LedgerWalkReportSchema = LedgerWalkReportSchema;
+    exports.LedgerWalkSkipCountsSchema = LedgerWalkSkipCountsSchema;
+    exports.LedgerWalkSkipReasonSchema = LedgerWalkSkipReasonSchema;
     exports.LinkedDeviceSchema = LinkedDeviceSchema;
     exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
     exports.ListGroupsPageSchema = ListGroupsPageSchema;
@@ -251291,6 +251887,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MaskShapeKindSchema = MaskShapeKindSchema;
     exports.MaskShapeSchema = MaskShapeSchema;
     exports.MediaFileInfoSchema = MediaFileInfoSchema;
+    exports.MediaFileKindEnum = MediaFileKindEnum;
     exports.MediaFileRefSchema = MediaFileRefSchema;
     exports.MediaFileSchema = MediaFileSchema;
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
@@ -251629,6 +252226,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.SceneConfirmSchema = SceneConfirmSchema;
     exports.SceneMonitorSchema = SceneMonitorSchema;
     exports.SceneMonitorStateSchema = SceneMonitorStateSchema;
+    exports.SceneMonitorStatusForDeviceSchema = SceneMonitorStatusForDeviceSchema;
     exports.SceneMonitorStatusSchema = SceneMonitorStatusSchema;
     exports.SceneReferenceSchema = SceneReferenceSchema;
     exports.SceneUnavailableSchema = SceneUnavailableSchema;
@@ -410449,6 +411047,7 @@ var require_cap_providers = __commonJS({
     exports.buildSettingsStoreGateway = buildSettingsStoreGateway;
     exports.buildNetworkQualityProvider = buildNetworkQualityProvider;
     exports.buildToastProvider = buildToastProvider;
+    exports.computeTopologyPass = computeTopologyPass;
     exports.computeTopology = computeTopology;
     exports.createNodeRootPackageLookup = createNodeRootPackageLookup;
     exports.buildNodesProvider = buildNodesProvider;
@@ -410597,9 +411196,19 @@ var require_cap_providers = __commonJS({
       }
       return ips;
     }
+    async function computeTopologyPass(agentRegistry, addonRegistry, getNodeRootPackage) {
+      const [nodes, liveNodes] = await computeTopologyInternal(agentRegistry, addonRegistry, getNodeRootPackage);
+      return { nodes, liveNodes };
+    }
     async function computeTopology(agentRegistry, addonRegistry, getNodeRootPackage) {
-      const nodes = await agentRegistry.listNodes();
-      const history = await agentRegistry.getClusterNodeHistory();
+      const [nodes] = await computeTopologyInternal(agentRegistry, addonRegistry, getNodeRootPackage);
+      return nodes;
+    }
+    async function computeTopologyInternal(agentRegistry, addonRegistry, getNodeRootPackage) {
+      const [nodes, history] = await Promise.all([
+        agentRegistry.listNodes(),
+        agentRegistry.getClusterNodeHistory()
+      ]);
       const historyById = new Map(history.map((h) => [h.id, h]));
       const liveIds = new Set(nodes.map((n) => n.info.id));
       const allAddons = addonRegistry?.listAddons() ?? [];
@@ -410754,7 +411363,7 @@ var require_cap_providers = __commonJS({
         categories: [],
         rootPackage: null
       }));
-      return [...liveNodes, ...offlineNodes];
+      return [[...liveNodes, ...offlineNodes], nodes];
     }
     function createNodeRootPackageLookup(moleculer, serverUpdate) {
       return (nodeId, isHub) => {
@@ -420480,6 +421089,19 @@ var require_agent_registry_service = __commonJS({
         addonIds: [...entry.agentAddons ?? []]
       };
     }
+    function toSubProcess(p) {
+      return {
+        pid: p.pid ?? 0,
+        name: p.name ?? "",
+        command: "moleculer-service",
+        state: p.state ?? "running",
+        cpuPercent: p.cpuPercent ?? 0,
+        memoryRss: p.memoryRss ?? 0,
+        uptimeSeconds: p.uptimeSeconds ?? 0,
+        addonIds: p.addonIds ?? [],
+        groupId: p.groupId ?? null
+      };
+    }
     var AgentRegistryService = class {
       eventBus;
       moleculer;
@@ -421006,107 +421628,113 @@ var require_agent_registry_service = __commonJS({
         return toNodeLiveness(this.moleculer.broker.registry.getNodeList({ onlyAvailable: false }));
       }
       async listNodes() {
-        let hubProcesses = [];
+        const registry = this.moleculer.broker.registry;
+        const nodes = registry?.getNodeList?.({ onlyAvailable: false }) ?? [];
+        const remoteTargets = nodes.filter((node) => typeof node.id === "string" && node.id !== "hub" && !node.id.includes("/"));
+        const [hubEntry, remoteEntries] = await Promise.all([
+          this.listHubProcesses().then((procs) => this.buildHubEntry(procs)),
+          Promise.all(remoteTargets.map((node) => node.available ? (
+            // Online: one wave of `$agent.status` + `$process.list`.
+            this.buildRemoteEntry(node.id)
+          ) : (
+            // Offline: skip the RPC fan-out entirely (the node is unreachable —
+            // those calls would just time out) and surface a minimal,
+            // honestly-degraded row instead.
+            Promise.resolve(this.buildOfflineEntry(node))
+          )))
+        ]);
+        return [hubEntry, ...remoteEntries.filter((entry) => entry !== null)];
+      }
+      /** The hub's own runner subprocesses (`$process.list`, hub-local). */
+      async listHubProcesses() {
         try {
           const processes = await this.broker.call("$process.list");
-          hubProcesses = processes.map((p) => ({
-            pid: p.pid ?? 0,
-            name: p.name ?? "",
-            command: "moleculer-service",
-            state: p.state ?? "running",
-            cpuPercent: p.cpuPercent ?? 0,
-            memoryRss: p.memoryRss ?? 0,
-            uptimeSeconds: p.uptimeSeconds ?? 0,
-            addonIds: p.addonIds ?? [],
-            groupId: p.groupId ?? null
-          }));
+          return processes.map(toSubProcess);
         } catch {
+          return [];
         }
-        const hubEntry = await this.buildHubEntry(hubProcesses);
-        const remoteEntries = [];
-        const registry = this.moleculer.broker.registry;
-        const nodes = registry?.getNodeList?.({ onlyAvailable: false }) ?? [];
-        for (const node of nodes) {
-          const nodeId = node.id;
-          if (typeof nodeId !== "string" || nodeId === "hub" || nodeId.includes("/"))
-            continue;
-          if (!node.available) {
-            remoteEntries.push(this.buildOfflineEntry(node));
-            continue;
-          }
-          try {
-            const status = await this.broker.call("$agent.status", {}, {
-              nodeID: nodeId,
-              timeout: 5e3
-            });
-            let subProcesses = [];
-            try {
-              const processes = await this.broker.call("$process.list", {}, {
-                nodeID: nodeId,
-                timeout: 5e3
-              });
-              subProcesses = processes.map((p) => ({
-                pid: p.pid ?? 0,
-                name: p.name ?? "",
-                command: "moleculer-service",
-                state: p.state ?? "running",
-                cpuPercent: p.cpuPercent ?? 0,
-                memoryRss: p.memoryRss ?? 0,
-                uptimeSeconds: p.uptimeSeconds ?? 0,
-                addonIds: p.addonIds ?? [],
-                groupId: p.groupId ?? null
-              }));
-            } catch {
-              subProcesses = status.addons?.map((a) => ({
-                pid: 0,
-                name: a.id ?? "",
-                command: "moleculer-service",
-                state: a.status ?? "running",
-                cpuPercent: 0,
-                memoryRss: 0,
-                uptimeSeconds: 0
-              })) ?? [];
-            }
-            const agentAddons = status.addons?.map((a) => a.id) ?? [];
-            const hostname = typeof status.hostname === "string" ? status.hostname : null;
-            const agentName = typeof status.name === "string" ? status.name : nodeId;
-            remoteEntries.push({
-              info: {
-                id: nodeId,
-                name: agentName,
-                hostname: hostname ?? nodeId,
-                capabilities: [],
-                platform: status.platform ?? "unknown",
-                arch: status.arch ?? "unknown",
-                cpuCores: status.cpuCores ?? 0,
-                memoryMB: status.totalMemoryMB ?? 0,
-                cpuModel: status.cpuModel
-              },
-              localIps: Array.isArray(status.localIps) ? status.localIps : [],
-              status: {
-                activeCameras: 0,
-                cpuPercent: status.cpuPercent ?? 0,
-                memoryPercent: status.memoryPercent ?? 0,
-                fps: {},
-                errors: []
-              },
-              connectedSince: typeof status.uptime === "number" ? Date.now() - status.uptime * 1e3 : Date.now(),
-              isHub: false,
-              subProcesses,
-              agentAddons
-            });
-          } catch {
-          }
-        }
-        await this.snapshotOnlineNodes([hubEntry, ...remoteEntries]);
-        return [hubEntry, ...remoteEntries];
       }
       /**
-       * Best-effort upsert of every online entry's descriptor into the history
-       * store. Never throws — the store swallows its own errors and this awaits
-       * `allSettled` so a storage hiccup can never fail `listNodes()`.
+       * One online agent's row: `$agent.status` for the descriptor + live metrics,
+       * `$process.list` for real sub-process stats. `null` when the node has no
+       * `$agent` service (it is then simply absent from the list, as before).
+       *
+       * The two calls are ONE wave, not two: `$process.list` never reads anything
+       * from `$agent.status` — only its FALLBACK does, and the fallback is applied
+       * after both have settled.
+       */
+      async buildRemoteEntry(nodeId) {
+        const [statusResult, processResult] = await Promise.allSettled([
+          this.broker.call("$agent.status", {}, { nodeID: nodeId, timeout: 5e3 }),
+          this.broker.call("$process.list", {}, { nodeID: nodeId, timeout: 5e3 })
+        ]);
+        if (statusResult.status === "rejected")
+          return null;
+        const status = statusResult.value;
+        const subProcesses = processResult.status === "fulfilled" ? processResult.value.map(toSubProcess) : (
+          // Fall back to the addon list from $agent.status (no stats)
+          status.addons?.map((a) => ({
+            pid: 0,
+            name: a.id ?? "",
+            command: "moleculer-service",
+            state: a.status ?? "running",
+            cpuPercent: 0,
+            memoryRss: 0,
+            uptimeSeconds: 0
+          })) ?? []
+        );
+        const agentAddons = status.addons?.map((a) => a.id) ?? [];
+        const hostname = typeof status.hostname === "string" ? status.hostname : null;
+        const agentName = typeof status.name === "string" ? status.name : nodeId;
+        return {
+          info: {
+            id: nodeId,
+            name: agentName,
+            hostname: hostname ?? nodeId,
+            capabilities: [],
+            platform: status.platform ?? "unknown",
+            arch: status.arch ?? "unknown",
+            cpuCores: status.cpuCores ?? 0,
+            memoryMB: status.totalMemoryMB ?? 0,
+            cpuModel: status.cpuModel
+          },
+          localIps: Array.isArray(status.localIps) ? status.localIps : [],
+          status: {
+            activeCameras: 0,
+            cpuPercent: status.cpuPercent ?? 0,
+            memoryPercent: status.memoryPercent ?? 0,
+            fps: {},
+            errors: []
+          },
+          connectedSince: typeof status.uptime === "number" ? Date.now() - status.uptime * 1e3 : Date.now(),
+          isHub: false,
+          subProcesses,
+          agentAddons
+        };
+      }
+      /**
+       * A1 (R2 capture point): snapshot every ONLINE node's static descriptor +
+       * last-known addon roster into the durable, routing-blind history store.
+       * This is the ONLY place cpuModel/cores/memory/localIps are resolved from a
+       * live `$agent.status`, so it is where an offline row's descriptor must be
+       * captured while the node is still reachable. Offline entries are NOT
+       * re-snapshotted — their `lastActive` is stamped on `$node.disconnected`
+       * instead. This is a separate durable store, never a `knownAgents`-style
+       * shadow of `HubNodeRegistry` (which stays the ephemeral live cap authority).
+       *
+       * **It belongs to the PERIODIC PASS, not to a read** (D317). It used to run
+       * at the tail of `listNodes()`, which made every operator poll of
+       * `nodes.topology` perform one durable read-back — and, past the five-minute
+       * heartbeat, one durable write — per online node, in a phase that had to
+       * finish before the history read could even start. Measured on the live hub
+       * on 2026-08-31: one settings-store round trip cost 14.8–18.3 s and
+       * `nodes.topology` cost exactly two of them, 30.5 s. `TopologyEmitterService`
+       * already recomputes this picture every 30 s; the capture is its work.
+       *
+       * Never throws — the store swallows its own errors and this awaits
+       * `allSettled` so a storage hiccup can never fail the pass.
        */
-      async snapshotOnlineNodes(entries) {
+      async captureNodeHistory(entries) {
         if (!this.historyStore)
           return;
         const online = entries.filter((e) => e.isOnline !== false);
@@ -423756,7 +424384,7 @@ var require_topology_emitter_service = __commonJS({
           return;
         this.emitting = true;
         try {
-          const nodes = await (0, cap_providers_1.computeTopology)(this.agentRegistry, this.addonRegistry, this.getNodeRootPackage);
+          const { nodes, liveNodes } = await (0, cap_providers_1.computeTopologyPass)(this.agentRegistry, this.addonRegistry, this.getNodeRootPackage);
           this.eventBus.emit({
             id: (0, node_crypto_1.randomUUID)(),
             timestamp: /* @__PURE__ */ new Date(),
@@ -423764,6 +424392,7 @@ var require_topology_emitter_service = __commonJS({
             category: types_1.EventCategory.ClusterTopologySnapshot,
             data: { nodes, timestamp: Date.now() }
           });
+          await this.agentRegistry.captureNodeHistory(liveNodes);
         } catch {
         } finally {
           this.emitting = false;